Skip to content

Fix crash in 'malloc' referring to function without a argument #159371

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Sep 17, 2025
Merged

Fix crash in 'malloc' referring to function without a argument #159371

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
35b6efd
Fix crash in 'malloc' referring to function without a argument
erichkeane Sep 17, 2025
9c4f6b7
Fix spelling of existent.
erichkeane Sep 17, 2025
4856799
Fix spelling of targetting
erichkeane Sep 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions clang/docs/ReleaseNotes.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -347,6 +347,9 @@ Bug Fixes in This Version
``-Wshadow`` and show uncaptured-local warnings with ``-Wshadow-all``. (#GH68605)
- Fixed a failed assertion with a negative limit parameter value inside of
``__has_embed``. (#GH157842)
- Fixed an assertion when an improper use of the ``malloc`` attribute targeting
a function without arguments caused us to try to access a non-existent argument.
(#GH159080)

Bug Fixes to Compiler Builtins
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Expand Down
6 changes: 5 additions & 1 deletion clang/lib/Sema/SemaDeclAttr.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1802,7 +1802,11 @@ static void handleRestrictAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
if (AL.getNumArgs() == 1) {
DeallocPtrIdx = ParamIdx(1, DeallocFD);

if (!DeallocPtrIdx.isValid() ||
// FIXME: We could probably be better about diagnosing that there IS no
// argument, or that the function doesn't have a prototype, but this is how
// GCC diagnoses this, and is reasonably clear.
if (!DeallocPtrIdx.isValid() || !hasFunctionProto(DeallocFD) ||
getFunctionOrMethodNumParams(DeallocFD) < 1 ||
!getFunctionOrMethodParamType(DeallocFD, DeallocPtrIdx.getASTIndex())
.getCanonicalType()
->isPointerType()) {
Expand Down
6 changes: 6 additions & 0 deletions clang/test/Sema/attr-args.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,3 +29,9 @@ __attribute__ ((__format_arg__(2))) // expected-error {{'__format_arg__' attribu
void test (int, ...);

void __attribute__ ((alloc_size (2, 3))) *test2(int, ...); // expected-error {{'alloc_size' attribute parameter 1 is out of bounds}}

void gh159080_a(void);
void *gh159080_b(void) __attribute__((malloc(gh159080_a))); // expected-error{{'malloc' argument 'gh159080_a' must take a pointer type as its first argument}}
void gh159080_c();
void *gh159080_d(void) __attribute__((malloc(gh159080_c))); // expected-error{{'malloc' argument 'gh159080_c' must take a pointer type as its first argument}}